Open Rights Group (ORG) is a digital rights organization based in the UK that is on a mission to protect citizens’ right to privacy and free speech online. Jim Killock, joined ORG in 2009 and has played a pivotal role in the work and development of the Open Rights Group.

Screenshot: Open Rights Group.

Mission & perspective

What core problem is the Open Rights Group trying to solve right now, and how can Tuta as well as the Tuta community get involved?

We are currently facing a real threat to our rights from powerful states and corporations. Both use digital technology to restrict, monitor and control people. We see this in expanding state surveillance across policing, welfare and immigration, AI-driven profiling and discrimination, and corporate concentration of power, where Big Tech lobbies governments to shape the laws it’s subject to. These forces entrench inequality, reduce rights and weaken our democracy.

So much of what we do at ORG is raising awareness of these concerns with the public and decision makers, and mobilising people to fight for their rights. By continuing to advocate for freedom of expression and privacy online, Tuta and its community can support us in this.

Has ORG’s mission evolved over the past few years?

Last year, ORG celebrated its 20th anniversary, which gave us pause to reflect on how far we’ve come and what new challenges we face. Over the years, we have championed digital rights in countless ways, with a focus on counter-surveillance, privacy and freedom of expression. While this still remains the case, our work has evolved to focus on the marginalised communities who are often the first to experience these digital rights abuses.

For a number of years, the UK has been leveraging AI, automated decision-making systems and other novel technologies, often trialling them on racialised, low-income, LGBTQIA, disabled and immigrant communities before they are deployed against the broader population. It’s vital that we stand up for those who are most impacted, which can also prevent these abuses from becoming more widespread.

Current threats to digital rights

Age verification is not only an issue in the UK, but it’s being introduced globally. Like the Open Rights Group, this is another privacy issue we advocate against at Tuta. Do you believe that this push for age verification is the biggest threat to privacy and online freedoms in the UK today?

The Online Safety Act requires online service providers to introduce age checks, and to prevent children from accessing certain kind of content, a process also known as age-gating. Since being introduced, restrictions have been placed on a wide range of content and app features, including sub Reddits on Gaza, sexual health and smoking, some Spotify videos, and computer games.

Unlike age checks we are familiar with in the offline world, online checks are a digital identity process that is often invasive of our privacy. If users are not allowed to self-declare their age, checks will be performed by:

• Scanning your face, or other biometric data, to guess your age; or

• Tracking and profiling your behaviour on a given online platform, and sharing these profiles with commercial data brokers, to guess who you are and how old are you;

• Asking you to submit your identity documents.

By providing no minimum standards for age assurance, the OSA allows the main drivers for age assurance to be primarily commercial. This leads to platforms relying mostly on US age assurance providers, with their permissive legal conditions and widespread surveillance. It also means that cost is the key driver, with platforms opting for low cost providers, who have lower security investments or collect additional user data in order to monetise it as part of their business model.

At Open Rights Group, we’re very concerned that many of these age assurance checks put users’ personal data at risk of fraud or scams. In June 2024, major identity verification company, AU10TIX, used by X, left login credentials exposed online for more than a year, allowing access to very sensitive user data. More recently, in October 2025, Discord carried out age checks by asking users to submit a proof of identification, resulting in a data breach affecting 70,000 users’ government issued IDs. As part of our recommendations for how to fix the UK’s Online Safety Act, we’re calling for regulation of age verification providers to make sure they adhere to high privacy and security standards.

Choose digital sovereignty

Sign up now

Encryption & secure communication

In EU the proposed regulation on Child Sexual Abuse (CSA), was pushing to undermine encryption and everyone’s privacy, but public backlash forced politicians to give up on the demand to break end-to-end encryption, which we at Tuta see as a huge win for privacy. Is undermining end-to-end encryption also a topic in the UK, and how do people push back?

Fighting to protect encryption is one of ORG’s priorities, and our supporters up and down the country are very passionate about this work.

“Encryption keeps our private information safe and secure. It’s essential for being safe online when sending messages, shopping, doing online banking, and for storing things safely in the cloud. Creating a backdoor to encryption is a threat to our right to privacy and cybersecurity. It’s not possible to scan in a way that only gets the ‘bad guys’ and leaves everyone else untouched. Nor is it possible to create a backdoor that only the ‘good guys’ can access. Instead, it leaves all of our data – whether that’s bank details or pictures of our children – exposed.”

ORG leads much of the work to protect encryption in the UK: we have organised interventions in litigation; mobilised businesses, human rights defenders and members; orchestrated joint publications and research; and engaged MPs in Parliament. Our members are vital to this work, mobilising at a local level and showing a groundswell of support for safeguarding encryption.

Tech companies & responsibility

What responsibilities do privacy-focused companies have beyond compliance? And where do you think tech companies fall short in protecting user rights?

The big point is that we need competitive markets, as much open code as possible, and ways to trust through verification. The goal of companies is first to survive, and to profit, and hopefully to serve real needs; these can be very ethical motivations. But it is hard for people to know what to trust, except through time and reputation.

This breaks down in the modern world, because regulators have allowed companies to “scale” exponentially, to the point that ethics inevitably go out of the window, in favour of strategies of world domination, whether of a sector, a market segment, or an industry. Once companies are in that position, ethics are impossible. User rights matter only in so far as it helps your marketing. More often, they get in the way of business interest. Trust and reputation are replaced by reliability and convenience, reinforced by network effects.

We should not accept that this is an inevitable feature of capitalism. In fact, it is a sure-fire way to erode and eventually end democracy, as successful companies leverage global resources. Extremes of wealth and poverty are one result. Now, prices for computers, phones and cameras are rising, and even the price of debt is spiralling, because of the current AI investment bubble. This only exists because of the concentration of capital investment in tech business monopolies.

“For ethical companies, I think the key is remaining at an ethical size and with an ethical business model. Embracing Open Source – whether wholly or in part – is a big part of this, alongside interoperability, so that customers can move should they wish. It’s the guarantees, rather than promises, that matter.”

Choose digital sovereignty

Sign up now

Activism & policy strategy

How does the Open Rights Group influence legislation or public opinion and what strategies have been most effective in defending digital rights?

We have often worked on legislation as it goes through Parliament, and we work with committees and MPs to amend legislation if needed.

However, public outrage is usually the most effective signal for change. The disquiet over ID Cards in the 2000s has made the topic of pervasive state digital identity controversial in the UK, for example. The Snowden revelations led to legislative and technology changes, including the rise of encrypted email. Public outrage drove those changes. In essence, governments overstepped, Snowden told the world, and things had to change. This fight goes on of course, as the use of encryption by ordinary people is disliked by state security bodies, despite the benefits in preventing fraud, theft, and other kinds of routine online crime.

When public opinion moves, this requires politicians to act, and gives campaigners space to push. Sometimes we move public opinion, but perhaps more often, mass public reactions to things that tech companies and governments do give us space to make the case for change.

The Digital Economy Act, and ‘three strikes’, is a case in point, where we did help shift public opinion. In 2010, both Labour and Conservatives voted to shut people’s internet accounts if someone had allegedly downloaded copyrighted material on their connection. This would have created collective household punishments for copyright infringement, at a time when Netflix and so on did not yet exist. Our arguments that copyright owners needed to serve the market were not heeded and the act came into force; but the level of public outrage in 2010 was enough for the government to be cautious, and the Act was never put into effect. It is still on the statute books, but remains inactive. Now the whole idea sounds ridiculous. So we lost, but also won.

We saw you have had 5 legal victories won, which was the biggest and why was it such a success?

On the legal battles, the case we were involved in against the UK government at Strasbourg is perhaps the most important, because it forced the UK to change legislation to avoid further challenges. But I am also very proud of the push against data retention in the UK, which at least forced the UK to stop police self-authorisation of data requests. Our fight to stop blanket GDPR exemptions for data relating to immigration was also a good victory, because it helped the migration sector resist the ambitions of the Home Office to abuse data for surveillance. I think it has also caused the government to be a bit more careful about introducing further overly wide exemptions. All that said, our ICO does not properly enforce GDPR, so there are limits to legal avenues in the UK where data protection is concerned.

The future of digital rights

Are we heading toward a more private or more surveilled internet?

Both are always happening simultaneously. There are more opportunities with AI for surveillance, as it’s baked into centralised, subscription AI. However, the desire for privacy pushes back, so people demand more privacy.

The balance we get depends on what people do for themselves. The concern is that convenience wins in the short term, until people see the harms. Commercial pressures lead in the wrong direction all too often. So we need regulation, action against monopolies, and personal action, to get the kind of society we want.

And lastly, a more personal question. What keeps you optimistic when at times the news feels so negative in this space?

Regarding optimism, there’s two things: the forces against us cannot win forever. We should all be worried that society will need a severe correction to make this happen, whether a crash, or an extremely unpleasant government, or worse. But people’s desire for freedom and fairness never goes away.